gh0strat | fd6eb81590d22d47002590865955daa2ed559be1e9805099c59f5cb74a788c58

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2023 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WPS_Installer_.exe
Size

4.1MB
MD5

6e2cde27cf0f6d43d92687a13aef3980
SHA1

c35a49b96c283ed47e1d80153b76dffc5d296286
SHA256

fd6eb81590d22d47002590865955daa2ed559be1e9805099c59f5cb74a788c58
SHA512

3a735cd61335547a11d6290ad34f3be7c012f6020dc991ccfd733e46e747ac36649a07b5cbfbf9fadf7d357adb93d2520de46fe3193e8df27645121011d55f22
SSDEEP

98304:QSBIC1oZLORr1CjckI7d3bajae4Q+65q49HwWkFoLE3L:5CfONJTOuFQq45WKL6

Score

10^/10

gh0strat purplefox bootkit persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral3/memory/3172-31-0x0000000010000000-0x0000000010199000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/3172-31-0x0000000010000000-0x0000000010199000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Executes dropped EXE 4 IoCs

Processes:

WPS_Installer.exedahai.exesetup_12012.2019_11.1.0.15313.exesetup_12012.2019_11.1.0.15313.exe

pid process

4168 WPS_Installer.exe
3172 dahai.exe
3344 setup_12012.2019_11.1.0.15313.exe
208 setup_12012.2019_11.1.0.15313.exe

pid	process
4168	WPS_Installer.exe
3172	dahai.exe
3344	setup_12012.2019_11.1.0.15313.exe
208	setup_12012.2019_11.1.0.15313.exe

Loads dropped DLL 4 IoCs

Processes:

setup_12012.2019_11.1.0.15313.exe

pid	process
3344	setup_12012.2019_11.1.0.15313.exe
3344	setup_12012.2019_11.1.0.15313.exe
3344	setup_12012.2019_11.1.0.15313.exe
3344	setup_12012.2019_11.1.0.15313.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral3/memory/208-0-0x0000000000400000-0x000000000050A000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\autFBD6.tmp	upx
C:\Users\Admin\AppData\Local\Temp\dahaima\WPS_Installer.exe	upx
behavioral3/memory/4168-15-0x0000000000C70000-0x0000000001213000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\dahaima\WPS_Installer.exe	upx
behavioral3/memory/208-21-0x0000000000400000-0x000000000050A000-memory.dmp	upx
behavioral3/memory/4168-29-0x0000000000C70000-0x0000000001213000-memory.dmp	upx
behavioral3/memory/4168-37-0x0000000000C70000-0x0000000001213000-memory.dmp	upx
behavioral3/memory/4168-57-0x0000000000C70000-0x0000000001213000-memory.dmp	upx
behavioral3/memory/4168-104-0x0000000000C70000-0x0000000001213000-memory.dmp	upx
behavioral3/memory/4168-105-0x0000000000C70000-0x0000000001213000-memory.dmp	upx
behavioral3/memory/4168-109-0x0000000000C70000-0x0000000001213000-memory.dmp	upx
behavioral3/memory/4168-110-0x0000000000C70000-0x0000000001213000-memory.dmp	upx
behavioral3/memory/4168-142-0x0000000000C70000-0x0000000001213000-memory.dmp	upx
behavioral3/memory/4168-164-0x0000000000C70000-0x0000000001213000-memory.dmp	upx
behavioral3/memory/4168-205-0x0000000000C70000-0x0000000001213000-memory.dmp	upx
behavioral3/memory/4168-206-0x0000000000C70000-0x0000000001213000-memory.dmp	upx
behavioral3/memory/4168-207-0x0000000000C70000-0x0000000001213000-memory.dmp	upx
behavioral3/memory/4168-213-0x0000000000C70000-0x0000000001213000-memory.dmp	upx
behavioral3/memory/4168-214-0x0000000000C70000-0x0000000001213000-memory.dmp	upx

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dahai.exe

description	ioc	process
File opened (read-only)	\??\J:	dahai.exe
File opened (read-only)	\??\K:	dahai.exe
File opened (read-only)	\??\V:	dahai.exe
File opened (read-only)	\??\Y:	dahai.exe
File opened (read-only)	\??\B:	dahai.exe
File opened (read-only)	\??\E:	dahai.exe
File opened (read-only)	\??\G:	dahai.exe
File opened (read-only)	\??\L:	dahai.exe
File opened (read-only)	\??\T:	dahai.exe
File opened (read-only)	\??\U:	dahai.exe
File opened (read-only)	\??\X:	dahai.exe
File opened (read-only)	\??\I:	dahai.exe
File opened (read-only)	\??\O:	dahai.exe
File opened (read-only)	\??\Q:	dahai.exe
File opened (read-only)	\??\R:	dahai.exe
File opened (read-only)	\??\S:	dahai.exe
File opened (read-only)	\??\Z:	dahai.exe
File opened (read-only)	\??\H:	dahai.exe
File opened (read-only)	\??\M:	dahai.exe
File opened (read-only)	\??\N:	dahai.exe
File opened (read-only)	\??\P:	dahai.exe
File opened (read-only)	\??\W:	dahai.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

WPS_Installer.exe

description ioc process

File opened for modification \??\PhysicalDrive0 WPS_Installer.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	WPS_Installer.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral3/memory/208-21-0x0000000000400000-0x000000000050A000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\seg\0	nsis_installer_1
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\seg\0	nsis_installer_2
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\setup_12012.2019_11.1.0.15313.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\setup_12012.2019_11.1.0.15313.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\setup_12012.2019_11.1.0.15313.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\setup_12012.2019_11.1.0.15313.exe	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

WPS_Installer_.exeWPS_Installer.exedahai.exe

pid	process
208	WPS_Installer_.exe
208	WPS_Installer_.exe
208	WPS_Installer_.exe
208	WPS_Installer_.exe
4168	WPS_Installer.exe
4168	WPS_Installer.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe
3172	dahai.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

dahai.exesetup_12012.2019_11.1.0.15313.exesetup_12012.2019_11.1.0.15313.exe

pid process

3172 dahai.exe
3344 setup_12012.2019_11.1.0.15313.exe
208 setup_12012.2019_11.1.0.15313.exe

pid	process
3172	dahai.exe
3344	setup_12012.2019_11.1.0.15313.exe
208	setup_12012.2019_11.1.0.15313.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

WPS_Installer_.exeWPS_Installer.exesetup_12012.2019_11.1.0.15313.exe

description	pid	process	target process
PID 208 wrote to memory of 4168	208	WPS_Installer_.exe	WPS_Installer.exe
PID 208 wrote to memory of 4168	208	WPS_Installer_.exe	WPS_Installer.exe
PID 208 wrote to memory of 4168	208	WPS_Installer_.exe	WPS_Installer.exe
PID 208 wrote to memory of 3172	208	WPS_Installer_.exe	dahai.exe
PID 208 wrote to memory of 3172	208	WPS_Installer_.exe	dahai.exe
PID 208 wrote to memory of 3172	208	WPS_Installer_.exe	dahai.exe
PID 4168 wrote to memory of 3344	4168	WPS_Installer.exe	setup_12012.2019_11.1.0.15313.exe
PID 4168 wrote to memory of 3344	4168	WPS_Installer.exe	setup_12012.2019_11.1.0.15313.exe
PID 4168 wrote to memory of 3344	4168	WPS_Installer.exe	setup_12012.2019_11.1.0.15313.exe
PID 3344 wrote to memory of 208	3344	setup_12012.2019_11.1.0.15313.exe	setup_12012.2019_11.1.0.15313.exe
PID 3344 wrote to memory of 208	3344	setup_12012.2019_11.1.0.15313.exe	setup_12012.2019_11.1.0.15313.exe
PID 3344 wrote to memory of 208	3344	setup_12012.2019_11.1.0.15313.exe	setup_12012.2019_11.1.0.15313.exe

C:\Users\Admin\AppData\Local\Temp\WPS_Installer_.exe
"C:\Users\Admin\AppData\Local\Temp\WPS_Installer_.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:208

C:\Users\Admin\AppData\Local\Temp\dahaima\WPS_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\dahaima\WPS_Installer.exe"
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4168

C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\setup_12012.2019_11.1.0.15313.exe
"C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\setup_12012.2019_11.1.0.15313.exe" -s -agreelicense -from=onlinestore -compatiblemso -createIcons -defaultOpen -defaultOpenPdf -defopenepubebook -defopenpic -curlangofinstalledproduct=zh_CN -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344

C:\ProgramData\kingsoft\20230825_40345\setup_12012.2019_11.1.0.15313.exe
"C:\ProgramData\kingsoft\20230825_40345\setup_12012.2019_11.1.0.15313.exe" -s -agreelicense -from=onlinestore -compatiblemso -createIcons -defaultOpen -defaultOpenPdf -defopenepubebook -defopenpic -curlangofinstalledproduct=zh_CN -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:208

C:\Users\Admin\AppData\Local\Temp\dahaima\dahai.exe
"C:\Users\Admin\AppData\Local\Temp\dahaima\dahai.exe"
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\kingsoft\20230825_40345\oem.ini

Filesize
364B

MD5
99b06f687b0c22a5a86b814eb7d08a06

SHA1
77481bf1dfaef42d6fc0ae5e83aa6b08c11b555b

SHA256
e000f375b905a6a71943360b44f20f295d86a77371ff58e6fe1a2e7a75091ea3

SHA512
8107463cabfa4cf9beb7d38b3ac29d281c689b9da0d069799ec5554cace51863e0885add510032c05e99a62cdf26bbe4bf2b2b6b6767c925691ec76ba806ef05

Download Submit
C:\ProgramData\kingsoft\20230825_40345\oem.ini

Filesize
364B

MD5
99b06f687b0c22a5a86b814eb7d08a06

SHA1
77481bf1dfaef42d6fc0ae5e83aa6b08c11b555b

SHA256
e000f375b905a6a71943360b44f20f295d86a77371ff58e6fe1a2e7a75091ea3

SHA512
8107463cabfa4cf9beb7d38b3ac29d281c689b9da0d069799ec5554cace51863e0885add510032c05e99a62cdf26bbe4bf2b2b6b6767c925691ec76ba806ef05

Download Submit
C:\ProgramData\kingsoft\20230825_40345\setup_12012.2019_11.1.0.15313.exe

Filesize
23.9MB

MD5
a215f4fe35aec89a5a20185777cdda2b

SHA1
c080d12f05143e6f1387820a6d3b60a9b513cf4e

SHA256
c30aa0ed42b393d57f690a6353718365f605976d5c7f585791fe8494407a6c0c

SHA512
93b4165da9a1e2f2362a102e7a3a58933f641d07092502b120a731015881fe912fb3695c6ae4bf0b8472cbdf050e50941d56f0741f28b4049d4e9092ce1a71ef

Download Submit
C:\ProgramData\kingsoft\20230825_40345\setup_12012.2019_11.1.0.15313.exe

Filesize
22.7MB

MD5
7a00998410df10504b9a4617ba2c6ba3

SHA1
978160db7b78d07fe29bcfc093785c78473efa13

SHA256
627f75fb85e99d4415936c06bb46c59a48a699314d482eb0543f7324385fe12e

SHA512
2c9de711dcb8b2a0edfdc54c45f589ab6ffa25102af650cca38f5ddd4f511b78fe3b7b49a9fd00e7923a39735a27b2442b3621769f3913ae537354d79e1df8ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\autFBD6.tmp

Filesize
2.9MB

MD5
b52ba2b99108c496389ae5bb81fa6537

SHA1
9073d8c4a1968be24357862015519f2afecd833a

SHA256
c6ac7d9add40b913112b265d4f366d9ef80bbd711049db085fc750fcad4e14d8

SHA512
6637506ee80d359e729e0011b97e8d827e14356393193247f502b7fcfbbca249dc045b8acfe4b31ce462468f421dc5d9a4e31183bedb66c45a9aa43c01f81397

Download Submit
C:\Users\Admin\AppData\Local\Temp\dahaima\WPS_Installer.exe

Filesize
2.9MB

MD5
b52ba2b99108c496389ae5bb81fa6537

SHA1
9073d8c4a1968be24357862015519f2afecd833a

SHA256
c6ac7d9add40b913112b265d4f366d9ef80bbd711049db085fc750fcad4e14d8

SHA512
6637506ee80d359e729e0011b97e8d827e14356393193247f502b7fcfbbca249dc045b8acfe4b31ce462468f421dc5d9a4e31183bedb66c45a9aa43c01f81397

Download Submit
C:\Users\Admin\AppData\Local\Temp\dahaima\WPS_Installer.exe

Filesize
2.9MB

MD5
b52ba2b99108c496389ae5bb81fa6537

SHA1
9073d8c4a1968be24357862015519f2afecd833a

SHA256
c6ac7d9add40b913112b265d4f366d9ef80bbd711049db085fc750fcad4e14d8

SHA512
6637506ee80d359e729e0011b97e8d827e14356393193247f502b7fcfbbca249dc045b8acfe4b31ce462468f421dc5d9a4e31183bedb66c45a9aa43c01f81397

Download Submit
C:\Users\Admin\AppData\Local\Temp\dahaima\dahai.exe

Filesize
1.6MB

MD5
174895d7e1a751397f161a785fb1b355

SHA1
27a56118d233adc9adcaaad95bedb0c8862c5277

SHA256
2609445b23bf24267c6c5b597d78a8cfedecde62fb5c567436829ecbce95d743

SHA512
2e9d5b7d247c9c2b3c38c4aecad08e217e2de7e3042c3eb67fb40e49c87c1709eeaec93119bbf4ea17464a75e8d1191795afbedc4f6bb62418a7619489df4d75

Download Submit
C:\Users\Admin\AppData\Local\Temp\dahaima\dahai.exe

Filesize
1.6MB

MD5
174895d7e1a751397f161a785fb1b355

SHA1
27a56118d233adc9adcaaad95bedb0c8862c5277

SHA256
2609445b23bf24267c6c5b597d78a8cfedecde62fb5c567436829ecbce95d743

SHA512
2e9d5b7d247c9c2b3c38c4aecad08e217e2de7e3042c3eb67fb40e49c87c1709eeaec93119bbf4ea17464a75e8d1191795afbedc4f6bb62418a7619489df4d75

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn7C8A.tmp\AccessControl.dll

Filesize
13KB

MD5
28c87a09fdb49060aa4ab558a2832109

SHA1
9213a24964cd479eac91d01ad54190f9c11d0c75

SHA256
933cadcd3a463484bbb3c45077afda0edbb539dfbe988efad79a88cae63bf95f

SHA512
413b3afe5a3b139a199f2a6954edc055eee3b312c3dffd568cfdbe1f740f07a7c27fbf7b2a0b6e3c3dd6ee358ce96cc1ca821883f055bf63ddebda854384700d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn7C8A.tmp\AccessControl.dll

Filesize
13KB

MD5
28c87a09fdb49060aa4ab558a2832109

SHA1
9213a24964cd479eac91d01ad54190f9c11d0c75

SHA256
933cadcd3a463484bbb3c45077afda0edbb539dfbe988efad79a88cae63bf95f

SHA512
413b3afe5a3b139a199f2a6954edc055eee3b312c3dffd568cfdbe1f740f07a7c27fbf7b2a0b6e3c3dd6ee358ce96cc1ca821883f055bf63ddebda854384700d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn7C8A.tmp\AccessControl.dll

Filesize
13KB

MD5
28c87a09fdb49060aa4ab558a2832109

SHA1
9213a24964cd479eac91d01ad54190f9c11d0c75

SHA256
933cadcd3a463484bbb3c45077afda0edbb539dfbe988efad79a88cae63bf95f

SHA512
413b3afe5a3b139a199f2a6954edc055eee3b312c3dffd568cfdbe1f740f07a7c27fbf7b2a0b6e3c3dd6ee358ce96cc1ca821883f055bf63ddebda854384700d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn7C8A.tmp\System.dll

Filesize
11KB

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn7C8A.tmp\v6svc_oem.dll

Filesize
192KB

MD5
500318167948bdd3ad42a40721e1a72b

SHA1
24134691693e6d78d6eb0a0c64833c12a0090968

SHA256
d3378ee739debcaee8c715963403d96bf025db98bfbb55e54635429890db85c6

SHA512
0a2d3b55528cc53cfce5b47158997300c562afd2c7bb5596532b218d3f482380887ee7c204b13d42425dc0c4cc439a7f9ed167f3767bda7b6e205e7e8f454863

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn7C8A.tmp\v6svc_oem.dll

Filesize
192KB

MD5
500318167948bdd3ad42a40721e1a72b

SHA1
24134691693e6d78d6eb0a0c64833c12a0090968

SHA256
d3378ee739debcaee8c715963403d96bf025db98bfbb55e54635429890db85c6

SHA512
0a2d3b55528cc53cfce5b47158997300c562afd2c7bb5596532b218d3f482380887ee7c204b13d42425dc0c4cc439a7f9ed167f3767bda7b6e205e7e8f454863

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\seg\0

Filesize
30.0MB

MD5
1b63582b871fd3341c8964c426a81c75

SHA1
89be332d3f651fcb6ebeabfcca67fd2134ce38a1

SHA256
d10b6171ae550b0669fc270402bdc71c46e4c5679275e421d4ce1bf3eed1552d

SHA512
ec31602f8efbc925a9adb3e447e01a2a35de3ce158d1d85b3c57a7c4d53c463062215231fabc4bb32477673a8ce66a56d1a4c208234fb9b93ab145b602d2cdb1

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\seg\1

Filesize
30.0MB

MD5
74b6ade18a9adf15ab109d2d5890d1f8

SHA1
bf37a01a41068311424e93e495433c25475e2a74

SHA256
1b5d1be36840a81bbb6880d491d4eac5d7550da075bc7016a8e981cce855d17b

SHA512
93b4065844da858c2152b24a3a8a329577ddba9e79669560bdeacc1c768024152e6e01943a330b22c3fb250f8d71e3bdeb3aa30d0834a3cf2c9cbd484d287bdc

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\seg\2

Filesize
30.0MB

MD5
a90103bb159811940286636b4e2255a4

SHA1
5f77403629825c624807d9b1484fd51319c409ad

SHA256
446406f05bd37686e5ced4a4edda5f5c35c08b0d32c656b47422a5a7995683e9

SHA512
d5d087959139d3d4f4b60e0e82c0e406718abf94416ddb94980221cc8d00154ac4537b60a9ddba4ea6fc6ad156e1f4e5681ef2164dc97cb2f16a3ff9a377f712

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\seg\3

Filesize
30.0MB

MD5
5e4e084e437aa0abdb88816ef988a099

SHA1
4a2b8da6e01de3b32eea64c81dfcf27315c82443

SHA256
341473be63b0ca7073c84ee5080800481b3fa3dfad73f2452a4b3303d3f37a9a

SHA512
514c35c5d6d740ac1c57c3188f1edbc1175003073a7cc4688b36d2448f6323977b509a437d8ff70bd14fe032340f71670e2c229b379e1bac3528a42ccd7e1e95

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\seg\4

Filesize
30.0MB

MD5
360dfd1ca3fe6d670e87fad062007b36

SHA1
4b47a76644d47ac76e68a93c11b1d38482678d80

SHA256
70a47febfe714f97f7389c880ff5703e219627fc5003f7cd36ee55005a17b4d5

SHA512
dd9342c768d49fba6fc9dd86b17d34ab53c8e859bb6a7d8767cf7b847a6d8762e219482206cdbbccecc0b679792b95ccd08988d6d398675aabbbb0512b551eed

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\seg\5

Filesize
30.0MB

MD5
e542291a244ce2ff7ea31f4d5a7f6153

SHA1
d84d03dada23f5cf05c38bf720cc09219bcdfdde

SHA256
a25de7c690e2692a7b9813d5c276aefad819e1ae687ea1045526140ce473c36e

SHA512
95def2d941984fbf9c7321641c621e8513666890dbeea0f6c28715f19dab56a3543cbee215221bdb6a5b030806b443b5a0fc9a48598dc4476b9d5810082d2866

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\seg\6

Filesize
30.0MB

MD5
1f5c2ea79a007c138a43dbb0c10af889

SHA1
4c311dd42c1ad8657486fd76bff9cf208e02a7ce

SHA256
6a79711951d97687d564a94ec9baff0d3626798773d9ed17f2fa2401aea3bc84

SHA512
f1af2973a3904bc503f3455965ce65ffbbf5b1324aac32471137e6fe8f4a62ef2e6ead0615dc72b4aeec109c1baa81230591846f38c23713a3350180d3748363

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\seg\7

Filesize
15.9MB

MD5
81697a5a0813f0b56e1b1d3569e3ae20

SHA1
3936f8cae156ce4e8544a9e3c23eb0d35253262e

SHA256
b0d0fee9097568525465b102278bf314b231cc869e838f8a36d5929a7b9aed14

SHA512
b066dbbfd55825e114d8f38498dfa1621a75e0e6f0f8edf8ce06f6ea91fc96448d736f3c4addda0ceee4d7801fcefcfd4c97e347f1d1fdf86b654aba5f41b545

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\setup_12012.2019_11.1.0.15313.exe

Filesize
225.9MB

MD5
0826566ea04e78d5fbd36e7758186961

SHA1
25927988b37f7d6e62eac8c257a955daa0689551

SHA256
f2e7a8e00f46ce0c73b78c3826952eb29dda0d0851d2d77a501ada9310036523

SHA512
b8fc423812bd6207404052bde46d9bfbabc1f9f3a83c0190f1221fa30be97ba31091e613f5a30a97aeeec769a4e9fab5d9037c58ae59515a4d4cea7ff259ee8c

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\wps_download\0826566ea04e78d5fbd36e7758186961\setup_12012.2019_11.1.0.15313.exe

Filesize
225.9MB

MD5
0826566ea04e78d5fbd36e7758186961

SHA1
25927988b37f7d6e62eac8c257a955daa0689551

SHA256
f2e7a8e00f46ce0c73b78c3826952eb29dda0d0851d2d77a501ada9310036523

SHA512
b8fc423812bd6207404052bde46d9bfbabc1f9f3a83c0190f1221fa30be97ba31091e613f5a30a97aeeec769a4e9fab5d9037c58ae59515a4d4cea7ff259ee8c

Download Submit
memory/208-0-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/208-21-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/3172-31-0x0000000010000000-0x0000000010199000-memory.dmp

Filesize
1.6MB

Download
memory/4168-104-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download
memory/4168-205-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download
memory/4168-105-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download
memory/4168-110-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download
memory/4168-57-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download
memory/4168-37-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download
memory/4168-164-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download
memory/4168-109-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download
memory/4168-206-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download
memory/4168-207-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download
memory/4168-213-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download
memory/4168-214-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download
memory/4168-29-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download
memory/4168-142-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download
memory/4168-15-0x0000000000C70000-0x0000000001213000-memory.dmp

Filesize
5.6MB

Download